CYBER.ORG Range
Product by Cyber Innovation Center
Facts checked: Not yet checked
Our take (not a Learning Standard rating). This label applies to learning-science judgments throughout this overview.
Our take (not a Learning Standard rating)
While The Learning Standard has not yet evaluated CYBER.ORG Range, its virtual sandbox approach aligns well with experiential learning principles. Providing a secure environment to practice cybersecurity skills allows students to apply theoretical knowledge safely. However, its effectiveness depends heavily on accompanying teacher-led instruction rather than standalone, self-paced learning.
Pros
- Offers a sandboxed virtual environment that supports experiential learning without real-world risks.
- Provides educators with structured lesson plans to scaffold complex cybersecurity concepts.
- Uses short instructional videos to reduce cognitive overload when introducing digital safety basics.
- Connects theoretical skills to concrete career pathways through active profile exploration.
Cons
- Relies heavily on external teacher facilitation rather than built-in, adaptive feedback loops.
- Lacks automated assessments to measure individual student mastery of hands-on technical skills.
- Does not utilize spaced repetition algorithms to ensure long-term retention of technical terminology.
What Do We Know About CYBER.ORG Range?
CYBER.ORG Range is effective for hands-on application of cybersecurity concepts, provided your child uses it alongside guided teacher instruction. This platform is not a self-contained learning game or a plug-and-play app. Instead, it acts as a virtual laboratory. Your child logs into a secure, cloud-based environment to practice technical skills, like defending against simulated cyber attacks or configuring networks, without risking your home computer or data. Educational research strongly supports this type of experiential learning, as interacting with authentic tools builds deeper mental models than reading alone. However, the platform itself does not teach the material adaptively. It lacks automated feedback mechanisms or mastery-based progression. If your child makes a mistake during a simulation, they rely on their classroom teacher to diagnose the error and provide corrective instruction. Because of this, it is highly valuable as an extension of a school curriculum but holds limited value as a standalone, self-paced learning tool at home.
How Does CYBER.ORG Range Work?
CYBER.ORG Range utilizes an experiential, problem-based learning approach through cloud-hosted virtual machines. Students log into a browser-based portal that simulates a real-world operating system and network environment. Inside this sandbox, they receive specific technical scenarios or challenges designed by their teacher using the platform's provided curriculum. Students execute commands, configure security settings, and analyze vulnerabilities within the virtual space. The mechanics mimic actual IT industry workflows. Because the environment is isolated, students can safely execute malicious code or intentionally break system configurations to observe the consequences. Alongside the practical range, the platform delivers direct instruction via short, targeted video modules covering foundational digital safety and career exploration. Teachers monitor progression manually, using the platform's supplemental lesson plans to guide classroom discussions and evaluate student success based on task completion rather than automated in-app grading.
Strengths and tradeoffs of CYBER.ORG Range
The biggest strength of CYBER.ORG Range is its authentic, risk-free environment for applying complex technical skills, while its biggest weakness is the complete absence of built-in, adaptive feedback. Experiential application is crucial for mastering computer science. By allowing students to interact with real operating systems and command-line interfaces, the platform bridges the gap between abstract concepts and practical execution. This hands-on approach builds robust cognitive schemas that static textbooks cannot replicate. Furthermore, the inclusion of worked examples in the provided teacher resources helps educators scaffold complex tasks for novices. However, the lack of automated feedback limits its independent utility. Learning science dictates that immediate, corrective feedback is essential for correcting misconceptions during skill acquisition. Because CYBER.ORG Range relies entirely on the classroom teacher to evaluate student actions within the virtual machines, students may practice incorrect procedures if the teacher's attention is divided. Additionally, the platform does not incorporate spaced retrieval practice for its theoretical content, meaning teachers must independently design quizzes or review sessions to ensure students retain the vocabulary and protocols over time.
Who Might Benefit From CYBER.ORG Range?
CYBER.ORG Range is best for middle and high school students enrolled in formal computer science or cybersecurity classes under the guidance of a trained educator. While the platform offers resources for K-12, the virtual range environment requires foundational technical knowledge and structured facilitation to be effective. It is an ideal resource for schools looking to provide authentic lab experiences without investing in expensive hardware or risking their local network security. It is not suitable for individual students seeking a self-paced coding or tech tutorial at home.
Data Transparency
Does Not Meet Data Transparency Standard
CYBER.ORG Range does not meet our data transparency standard. Its privacy policy does not document basic protections, including limits on sharing children's data, parents' right to see their child's data and parents' right to delete their child's data.
17 of 35 checks passed
Evaluated September 2026
Terms and Conditions of Site Use & Data Policy →Level 1 · Basic protections
Does not sell data or target ads at students, limits sharing, and lets parents see and delete their child's data.
Not documented: limits on sharing children's data, parents' right to see their child's data, parents' right to delete their child's data
Level 2 · Parent control (meets the standard)
Families can get their data out, know who processes it, and know how long it is kept.
Not documented: data export, a data retention timeline, self-service deletion
Level 3 · Direct data access
Families or schools can pull their own data through an API, in a stated format.
Not documented: an API for retrieving their own data, a named export format
View all 35 checks
Parent Access5/8
Does the policy mention parents specifically?
“Where required by law, verifiable parental consent is obtained prior to account creation.”
Can parents view their child's data?
The policy gives individuals a right to request access but does not give parents a right to view their child's data.
Can parents modify their child's data?
The policy gives individuals a right to request correction but does not give parents a right to modify their child's data.
Can parents delete their child's account?
The policy gives users a right to request deletion but does not give parents a right to delete their child's data or account.
Is there a dedicated Children's Privacy section?
“8\. Children’s Privacy The CIC is committed to compliance with COPPA and FERPA.”
Does it reference COPPA compliance?
“The CIC is committed to compliance with COPPA and FERPA.”
Does it reference FERPA compliance?
“The CIC is committed to compliance with COPPA and FERPA.”
Is parental consent required for child accounts?
“Where required by law, verifiable parental consent is obtained prior to account creation.”
Data Portability1/5
Can users access their personal data?
“Individuals have the right to: i. Request access to collected data”
Can users download/export their data?
The policy does not mention downloading or exporting data.
Is there a self-service data access tool?
The policy handles access requests by email to apps@cyber.org and describes no self-service tool.
Is a specific data format mentioned for export?
The policy does not name any export format.
Is there an API for data access?
The policy mentions only that Heroku hosts CYBER.ORG APIs and describes no API for users to retrieve their data.
Data Minimization1/6
Is data collection itemized?
“i. Account Registration Data: a. First and last name b. Email address c. Name of school or organization and school district”
Can the app be used without a real name?
The policy lists first and last name as registration data and lists Student as a role, so it does not rule out collecting student names.
Can the app be used without an email?
The policy lists email address as registration data and lists Student as a role, so it does not rule out collecting student emails.
Does it state collection is limited to what is necessary?
The policy mentions data minimization only for data shared with providers and does not say collection is limited to what is necessary.
Is IP address anonymized or truncated?
The policy says it collects IP addresses and does not say they are anonymized or truncated.
Is location tracking explicitly excluded?
The policy says it collects location data, including approximate location based on IP address.
Third-Party Protection5/7
Does it explicitly state no selling of data?
“We never sell data to anyone for any purpose.”
Are third-party providers named?
“To operate our Sites and services, we use trusted third-party service providers, including, but not limited to, the following: Heroku (Salesforce)”
Are providers contractually restricted?
“These third-party service providers are permitted to process data solely to provide services that support Cyber.org’s operations and educational programs.”
No-targeted-advertising commitment?
“We do not use or share data for advertising purposes, including displaying advertisements.”
Is AI/ML data sharing addressed?
The policy does not address sharing data with AI or machine learning systems.
Child-specific sharing restriction?
The policy has no sharing restriction that applies specifically to children's data.
Cookies/tracking limited or opt-out?
“We do not use cookies or tokens for advertising, third-party behavioral tracking, or profiling.”
Deletion & Retention1/5
Can users delete their account?
“You may request deletion of your data by contacting [apps@cyber.org](mailto:apps@cyber.org).”
Self-service deletion mechanism?
The policy handles deletion only by email request and describes no self-service mechanism.
Specific data retention timeline?
The policy gives no specific data retention period.
Auto-deletion of inactive accounts?
The policy says only that sessions expire after inactivity and does not mention deleting inactive accounts.
Post-deletion handling described?
The policy says only that deletion will be confirmed, subject to legal or reporting obligations, and does not describe what happens to data afterwards.
Advertising4/4
Advertising model explicitly disclosed?
“We do not use or share data for advertising purposes, including displaying advertisements.”
Free from third-party advertisements?
“We do not use or share data for advertising purposes, including displaying advertisements.”
Children excluded from ad targeting?
“We do not use or share data for advertising purposes, including displaying advertisements.”
Ad-free option available?
“We do not use or share data for advertising purposes, including displaying advertisements.”
What This Means
The policy review did not meet our data transparency standard. The checks above show the documented findings and unknowns. A missing statement does not establish how the app handles data in practice.
About this evaluation: Based on automated analysis of Terms and Conditions of Site Use & Data Policy against 35 policy-disclosure questions, including questions adapted from the Common Sense Privacy Program's published evaluation questions. TLS is not affiliated with Common Sense Media, and this is not a Common Sense rating. Quoted text is copied from the policy; unquoted notes are our summary. Results describe what the policy documents, not the company's actual practices. Privacy policies can change: this review reflects the version we analyzed and does not determine legal compliance.
Sources and review method
TLS combines product information and editorial analysis to explain how CYBER.ORG Range works, its tradeoffs, and the questions to ask before choosing it. Product features, an instructional rationale and evidence of learning outcomes are different kinds of information.
Formal Learning Standard assessment: not yet completed. Data Transparency findings are reported separately and do not establish learning effectiveness. Read our methodology.
Frequently Asked Questions About CYBER.ORG Range
Is CYBER.ORG Range free?
Yes, CYBER.ORG Range is completely free for K-12 educators and students in the United States. Funding is provided through a grant from the Cybersecurity and Infrastructure Security Agency (CISA), meaning schools can access the virtual environments and curriculum without any licensing fees. This removes financial barriers for districts wanting to implement robust technical education.
Is CYBER.ORG Range good for elementary students?
Primarily, no. While the platform provides basic cyber safety videos suitable for younger children, the core virtual range environment is strictly designed for middle and high school students. The complex technical interfaces, command-line operations, and problem-solving required in the virtual machines exceed the cognitive load appropriate for early elementary grades.
What does CYBER.ORG Range teach?
CYBER.ORG Range teaches practical cybersecurity skills, network configuration, and digital citizenship. Students learn how to identify system vulnerabilities, understand basic encryption principles, practice ethical hacking techniques in a secure environment, and explore technical career pathways. It focuses heavily on applying theoretical computer science concepts to simulated real-world scenarios.
Has The Learning Standard evaluated CYBER.ORG Range?
TLS has not yet completed a Learning Standard evaluation of how well CYBER.ORG Range teaches. Its privacy policy has been reviewed for Data Transparency and does not yet document the basic protections (Level 1).
Is CYBER.ORG Range COPPA compliant?
The reviewed privacy policy references COPPA. A policy reference alone does not establish COPPA compliance. Policy review note: The policy commits to COPPA compliance.
Is CYBER.ORG Range FERPA compliant?
The reviewed privacy policy references FERPA. A policy reference alone does not establish FERPA compliance. Policy review note: The policy commits to FERPA compliance.
Does CYBER.ORG Range have a children's privacy policy?
The reviewed policy includes a dedicated children's privacy section. Policy review note: The policy has a section headed Children's Privacy.
Does CYBER.ORG Range sell student data?
The reviewed policy states that the app does not sell data. This is a policy statement; actual data practices were not verified. Policy review note: The policy states that the vendor never sells data.
Can you delete your data from CYBER.ORG Range?
The reviewed privacy policy describes account deletion. We have not tested the deletion process. Policy review note: Users can request deletion of their data by email.
Follow TLS Research
Subscribe to future TLS research updates: app reviews, findings, and what the evidence shows.
Screenshots
Take Action
For CYBER.ORG Range
If you represent Cyber Innovation Center and have a correction or new evidence, send the relevant source so we can review and update this page.
Submit a correctionDetails
- Pricing
- Free
- Website
- Visit site